yml/hello_js_reverse_skill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(诊断): 用真机复现解出 1ms 成功会话的 collect 明文 —— 归因改写为「cd 槽位序按会话随机」

Browse Source 
结论 (已知 #29~#32, 推翻旧 #25/#27 与"collect 逐字节同构"这条否定实验):
  * 同一个 tdc.js URL 每次请求返回不同构建 (4/4 md5 + XTEA 密钥全不同)
  * 同会话同时抓 tdc.js + verify -> 解密出真机 collect 明文 (784B/38 槽, 可打印率 .991)
  * 5 份同日样本 (真机 cap2 / 签到成功-1 / 点选 / login_checkin / 仓库模板) 全部 38 槽、
    同一批取值、同一个 sd, 但槽位序 5/5 互不相同
  * 仓库在用的模板槽位序 == 签到成功-1 那一次; generate_collect_success() 只回填
    轨迹/时间戳/entry_url, 槽位序仍是那一次的

=> 头号可证伪假设 H-LAYOUT: 服务端按"本次会话构建"的槽位表解释 cd, 用别的会话的槽位序
   会被读成自相矛盾的环境 -> 12 (答案错理应是 50/9)。这也解释了为何换 IP / 换遥测后端 /
   换传输指纹 / 换 cookie / 长静默全都无效 —— 它们都不动槽位序。

新增:
  * scripts/analyze_collect_layout.py —— collect 槽位序对比 (复现 #31)
  * tcaptcha/slider_solver.py + test —— 滑块缺口求解 (ZNCC, 真机首轮命中 ret=0)
  * tcaptcha/icon_click_solver.py + test —— 图文点选形状模板求解
  * scripts/bridge_1ms_captcha.py —— 真机桥接三模式 (slider/icon/text) + --probe 题型侦察
  * tools/cdp_eval.js / cdp_click.js / cdp_shot.js / cdp_net_capture.js / cdp_capture.js
  * selftest 纳入 icon_click / slider 两个套件

账本: §一 修正 #25/#27、新增 #29~#32; §三 标注"collect 逐字节同构"否定实验有缺陷;
      §五 重写 12 的归因与下一步 (决定性实验 A + 取槽位表两条路)
This commit is contained in:
yml2213
2026-10-11 23:59:42 +08:00
parent bc8cc5e124
commit c55f833c66
17 changed files with 1716 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/cdp_capture.js
+118
View File
@@ -0,0 +1,118 @@
#!/usr/bin/env node
/**
* cdp_capture.js —— 用 CDP 抓**全部目标**(含 OOPIF iframe)的请求 + 响应体, 存成 JSON。
*
* 为什么需要它 (而不是 cdp_net_capture.js):
* 1. 腾讯验证码 iframe (turing.captcha.gtimg.com) 与页面 (1ms.run) **不同站**,
* Chrome 站点隔离下它是独立的 target; 只 attach 顶层页面会**漏掉**验证码自己的
* prehandle / getcapbysig / verify 请求。
* 2. 排查 errorCode=12 需要看**响应体**, cdp_net_capture.js 只记 requestWillBeSent。
*
* 零依赖 (Node >= 22 内置 WebSocket / fetch)。
*
* 用法:
* node tools/cdp_capture.js --seconds 30 --url-substr cap_union --out /tmp/cap.json
* node tools/cdp_capture.js --list
*
* 选项:
* --port N 调试端口 (默认 9222)
* --seconds N 抓取时长 (默认 20)
* --url-substr S 只保留 url 含 S 的请求 (可选; 响应体只对命中的取)
* --out PATH 输出 JSON (默认 /tmp/cdp_capture.json)
* --bodies 额外抓响应体 (默认开)
*/
const fs = require('fs');
function arg(name, def) {
const i = process.argv.indexOf('--' + name);
if (i < 0) return def;
const v = process.argv[i + 1];
return (v === undefined || v.startsWith('--')) ? true : v;
}
class Cdp {
constructor(ws, tag) { this.ws = ws; this.tag = tag; this.id = 0; this.waits = new Map(); this.handlers = []; }
static async connect(url, tag) {
const ws = new WebSocket(url);
await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
const c = new Cdp(ws, tag);
ws.onmessage = ev => {
const m = JSON.parse(ev.data);
if (m.id && c.waits.has(m.id)) {
const { res, rej } = c.waits.get(m.id);
c.waits.delete(m.id);
m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
} else if (m.method) {
for (const h of c.handlers) h(m);
}
};
return c;
}
send(method, params = {}) {
const id = ++this.id;
this.ws.send(JSON.stringify({ id, method, params }));
return new Promise((res, rej) => this.waits.set(id, { res, rej }));
}
on(fn) { this.handlers.push(fn); }
close() { try { this.ws.close(); } catch (e) {} }
}
const sleep = ms => new Promise(r => setTimeout(r, ms));
(async () => {
const port = parseInt(arg('port', '9222'), 10);
if (arg('list', false)) {
const t = await (await fetch(`http://127.0.0.1:${port}/json/list`)).json();
for (const x of t) console.log(`${x.type}\t${(x.url || '').slice(0, 110)}\t${x.id}`);
return;
}
const seconds = parseInt(arg('seconds', '20'), 10);
const substrArg = arg('url-substr', null);
const substrs = substrArg && substrArg !== true ? String(substrArg).split(',').filter(Boolean) : null;
const out = arg('out', '/tmp/cdp_capture.json');
const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
.filter(t => t.type === 'page' || t.type === 'iframe');
const conns = [];
const records = [];
const byReq = new Map();
for (const t of targets) {
let cdp;
try { cdp = await Cdp.connect(t.webSocketDebuggerUrl, t.url || t.id); } catch (e) { continue; }
conns.push(cdp);
const key = (p) => `${cdp.tag}|${p.requestId}`;
cdp.on(m => {
if (m.method === 'Network.requestWillBeSent') {
const r = m.params.request;
if (substrs && !substrs.some(s => r.url.includes(s))) return;
const rec = {
target: cdp.tag, url: r.url, method: r.method,
headers: r.headers, postData: r.postData || null,
ts: Date.now(),
};
records.push(rec);
byReq.set(key(m.params), rec);
} else if (m.method === 'Network.responseReceived') {
const rec = byReq.get(key(m.params));
if (rec) {
rec.status = m.params.response.status;
rec.respHeaders = m.params.response.headers;
rec.mimeType = m.params.response.mimeType;
}
} else if (m.method === 'Network.loadingFinished') {
const rec = byReq.get(key(m.params));
if (rec && rec.status && !rec.body) {
cdp.send('Network.getResponseBody', { requestId: m.params.requestId })
.then(b => { rec.body = b.body; rec.base64 = !!b.base64Encoded; })
.catch(() => {});
}
}
});
await cdp.send('Network.enable');
}
console.error(`[cdp_capture] attached ${conns.length} targets, capturing ${seconds}s ...`);
await sleep(seconds * 1000);
for (const c of conns) c.close();
fs.writeFileSync(out, JSON.stringify({ capturedAt: new Date().toISOString(), records }, null, 2));
console.error(`[cdp_capture] wrote ${records.length} records -> ${out}`);
})().catch(e => { console.error('CDP_ERROR: ' + e.message); process.exit(1); });
tools/cdp_click.js
+94
View File
@@ -0,0 +1,94 @@
#!/usr/bin/env node
/**
* cdp_click.js —— 用 CDP 在页面里派发**真实(trusted)鼠标事件** (点击 / 拖动)。
* 用于驱动真实浏览器里的验证码 widget (合成 MouseEvent 会被 isTrusted 检测)。
*
* 用法:
* # 依次点击若干点 (页面视口坐标)
* node tools/cdp_click.js --match 1ms.run --clicks "520,700;300,600"
* # 拖动: 从 (x,y) 水平/任意拖到 (x2,y2), 分 steps 步 (带中间移动)
* node tools/cdp_click.js --match 1ms.run --drag "200,700,600,700,30"
*
* 注意: 坐标是**顶层页面视口**坐标 (iframe 内的元素要先换算成页面坐标)。
*/
function arg(name, def) {
const i = process.argv.indexOf('--' + name);
if (i < 0) return def;
const v = process.argv[i + 1];
return (v === undefined || v.startsWith('--')) ? true : v;
}
class Cdp {
constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); }
static async connect(url) {
const ws = new WebSocket(url);
await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
const c = new Cdp(ws);
ws.onmessage = ev => {
const m = JSON.parse(ev.data);
if (m.id && c.waits.has(m.id)) {
const { res, rej } = c.waits.get(m.id);
c.waits.delete(m.id);
m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
}
};
return c;
}
send(method, params = {}) {
const id = ++this.id;
this.ws.send(JSON.stringify({ id, method, params }));
return new Promise((res, rej) => this.waits.set(id, { res, rej }));
}
close() { try { this.ws.close(); } catch (e) {} }
}
const sleep = ms => new Promise(r => setTimeout(r, ms));
(async () => {
const port = parseInt(arg('port', '9222'), 10);
const match = arg('match', null);
const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
.filter(t => t.type === 'page');
const target = match ? targets.find(t => (t.url || '').includes(match)) : targets[0];
if (!target) throw new Error('没有可用标签页');
const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
const click = async (x, y) => {
const base = { x: Math.round(x), y: Math.round(y), button: 'left', clickCount: 1,
buttons: 1, pointerType: 'mouse' };
await cdp.send('Input.dispatchMouseEvent', { type: 'mouseMoved', ...base, buttons: 0 });
await sleep(40);
await cdp.send('Input.dispatchMouseEvent', { type: 'mousePressed', ...base });
await sleep(60);
await cdp.send('Input.dispatchMouseEvent', { type: 'mouseReleased', ...base });
await sleep(260);
};
const clicks = arg('clicks', null);
if (clicks && clicks !== true) {
for (const p of String(clicks).split(';')) {
const [x, y] = p.split(',').map(Number);
if (Number.isFinite(x) && Number.isFinite(y)) await click(x, y);
}
console.log(JSON.stringify({ clicked: String(clicks).split(';').length, target: target.url }));
}
const drag = arg('drag', null);
if (drag && drag !== true) {
const [x1, y1, x2, y2, steps] = String(drag).split(',').map(Number);
const n = steps || 30;
const base = { button: 'left', buttons: 1, pointerType: 'mouse', clickCount: 1 };
await cdp.send('Input.dispatchMouseEvent', { type: 'mouseMoved', x: x1, y: y1, buttons: 0 });
await sleep(80);
await cdp.send('Input.dispatchMouseEvent', { type: 'mousePressed', x: x1, y: y1, ...base });
for (let i = 1; i <= n; i++) {
const t = i / n;
const ease = t < 0.5 ? 2 * t * t : 1 - Math.pow(-2 * t + 2, 2) / 2;
const x = x1 + (x2 - x1) * ease + (Math.random() - 0.5) * 1.5;
const y = y1 + (y2 - y1) * ease + (Math.random() - 0.5) * 1.5;
await cdp.send('Input.dispatchMouseEvent', { type: 'mouseMoved', x: Math.round(x), y: Math.round(y), ...base });
await sleep(12 + Math.random() * 10);
}
await cdp.send('Input.dispatchMouseEvent', { type: 'mouseReleased', x: x2, y: y2, ...base });
console.log(JSON.stringify({ dragged: [x1, y1, x2, y2], steps: n, target: target.url }));
}
cdp.close();
})().catch(e => { console.error('CDP_ERROR: ' + e.message); process.exit(1); });
tools/cdp_eval.js
+110
View File
@@ -0,0 +1,110 @@
#!/usr/bin/env node
/**
* cdp_eval.js —— 极简 CDP 工具: 连上**已经在跑的** Chrome(需带 --remote-debugging-port),
* 在指定标签页里求值一段 JS 并把结果按 JSON 打印回来。
*
* 零依赖: 只用 Node >= 22 内置的全局 WebSocket / fetch。
*
* 用法:
* node tools/cdp_eval.js --port 9222 --match 1ms.run --file /tmp/expr.js
* echo 'document.title' | node tools/cdp_eval.js --port 9222 --match 1ms.run
* node tools/cdp_eval.js --list # 列出所有标签页
*
* 选项:
* --port N 调试端口 (默认 9222)
* --match SUBSTR 选 url 含该子串的标签页 (默认第一个 page)
* --file PATH 从文件读表达式 (等价 awaitPromise)
* --reload 求值前先 reload 一次并等待 load
* --timeout MS 默认 30000
*/
const fs = require('fs');
function arg(name, def) {
const i = process.argv.indexOf('--' + name);
if (i < 0) return def;
const v = process.argv[i + 1];
return (v === undefined || v.startsWith('--')) ? true : v;
}
async function listTargets(port) {
const r = await fetch(`http://127.0.0.1:${port}/json/list`);
return r.json();
}
class Cdp {
constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.events = []; }
static async connect(url) {
const ws = new WebSocket(url);
await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
const c = new Cdp(ws);
ws.onmessage = ev => {
const m = JSON.parse(ev.data);
if (m.id && c.waits.has(m.id)) {
const { res, rej } = c.waits.get(m.id);
c.waits.delete(m.id);
m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
} else if (m.method) {
c.events.push(m);
}
};
return c;
}
send(method, params = {}) {
const id = ++this.id;
this.ws.send(JSON.stringify({ id, method, params }));
return new Promise((res, rej) => this.waits.set(id, { res, rej }));
}
close() { try { this.ws.close(); } catch (e) {} }
}
const sleep = ms => new Promise(r => setTimeout(r, ms));
(async () => {
const port = parseInt(arg('port', '9222'), 10);
const timeout = parseInt(arg('timeout', '30000'), 10);
if (arg('list', false)) {
const t = await listTargets(port);
for (const x of t) console.log(`${x.type}\t${(x.url || '').slice(0, 120)}\t${x.id}`);
return;
}
const match = arg('match', null);
const targets = (await listTargets(port)).filter(t => t.type === 'page' || t.type === 'iframe');
let target = null;
if (match) target = targets.find(t => (t.url || '').includes(match));
if (!target) target = targets[0];
if (!target) throw new Error('没有可用标签页');
const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
await cdp.send('Runtime.enable');
if (arg('reload', false)) {
await cdp.send('Page.enable');
await cdp.send('Page.reload', { ignoreCache: true });
await sleep(2500);
}
let expr;
const file = arg('file', null);
if (file && file !== true) expr = fs.readFileSync(file, 'utf8');
else {
expr = fs.readFileSync(0, 'utf8'); // stdin
}
if (!expr.trim()) throw new Error('表达式为空');
const res = await cdp.send('Runtime.evaluate', {
expression: expr,
awaitPromise: true,
returnByValue: true,
timeout,
});
const out = {
target: { url: target.url, title: target.title, id: target.id },
ok: !res.exceptionDetails,
result: res.result ? res.result.value : null,
exception: res.exceptionDetails ? (res.exceptionDetails.exception || {}).description : null,
};
console.log(JSON.stringify(out, null, 2));
cdp.close();
})().catch(e => { console.error('CDP_ERROR: ' + e.message); process.exit(1); });
tools/cdp_net_capture.js
+81
View File
@@ -0,0 +1,81 @@
#!/usr/bin/env node
/**
* cdp_net_capture.js —— 用 CDP 抓某个标签页的网络请求(含 postData), 用于拿到
* 前端**现场生成**的请求体 (如 1ms 的 /api/v1/captcha/params 里的 identity_context)。
*
* 零依赖: 只用 Node >= 22 内置 WebSocket / fetch。
*
* 用法:
* node tools/cdp_net_capture.js --port 9222 --match 1ms.run --url-substr captcha/params --reload
* node tools/cdp_net_capture.js --match 1ms.run --url-substr captcha/params --reload --wait 6000
*/
const fs = require('fs');
function arg(name, def) {
const i = process.argv.indexOf('--' + name);
if (i < 0) return def;
const v = process.argv[i + 1];
return (v === undefined || v.startsWith('--')) ? true : v;
}
class Cdp {
constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.handlers = []; }
static async connect(url) {
const ws = new WebSocket(url);
await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
const c = new Cdp(ws);
ws.onmessage = ev => {
const m = JSON.parse(ev.data);
if (m.id && c.waits.has(m.id)) {
const { res, rej } = c.waits.get(m.id);
c.waits.delete(m.id);
m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
} else if (m.method) {
for (const h of c.handlers) h(m);
}
};
return c;
}
send(method, params = {}) {
const id = ++this.id;
this.ws.send(JSON.stringify({ id, method, params }));
return new Promise((res, rej) => this.waits.set(id, { res, rej }));
}
on(fn) { this.handlers.push(fn); }
close() { try { this.ws.close(); } catch (e) {} }
}
const sleep = ms => new Promise(r => setTimeout(r, ms));
(async () => {
const port = parseInt(arg('port', '9222'), 10);
const match = arg('match', null);
const substr = arg('url-substr', null);
const wait = parseInt(arg('wait', '8000'), 10);
const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
.filter(t => t.type === 'page');
let target = match ? targets.find(t => (t.url || '').includes(match)) : targets[0];
if (!target) throw new Error('没有可用标签页');
const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
const reqs = [];
cdp.on(m => {
if (m.method === 'Network.requestWillBeSent') {
const r = m.params.request;
if (!substr || r.url.includes(substr)) {
reqs.push({
url: r.url, method: r.method, headers: r.headers,
postData: r.postData || null, at: Date.now(),
});
}
}
});
await cdp.send('Network.enable');
await cdp.send('Page.enable');
if (arg('reload', false)) {
await cdp.send('Page.reload', { ignoreCache: true });
}
await sleep(wait);
console.log(JSON.stringify({ target: target.url, captured: reqs }, null, 2));
cdp.close();
})().catch(e => { console.error('CDP_ERROR: ' + e.message); process.exit(1); });
tools/cdp_shot.js
+77
View File
@@ -0,0 +1,77 @@
#!/usr/bin/env node
/**
* cdp_shot.js —— 用 CDP 对**已经在跑的** Chrome 某个标签页截图存成 PNG。
* 零依赖 (Node >= 22 内置 WebSocket/fetch)。
*
* 用法:
* node tools/cdp_shot.js --match drag_ele --out /tmp/a.png # 整页
* node tools/cdp_shot.js --match drag_ele --out /tmp/a.png --clip 10,68,340,243
* node tools/cdp_shot.js --list
*
* 选项:
* --port N 调试端口 (默认 9222)
* --match SUBSTR 选 url 含该子串的 page/iframe 标签页 (默认第一个)
* --out PATH 输出 PNG 路径 (默认 /tmp/cdp_shot.png)
* --clip x,y,w,h 只截该区域 (CSS px, 相对该标签页视口)
* --scale N 设备像素比 (默认 1)
*/
const fs = require('fs');
function arg(name, def) {
const i = process.argv.indexOf('--' + name);
if (i < 0) return def;
const v = process.argv[i + 1];
return (v === undefined || v.startsWith('--')) ? true : v;
}
class Cdp {
constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); }
static async connect(url) {
const ws = new WebSocket(url);
await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
const c = new Cdp(ws);
ws.onmessage = ev => {
const m = JSON.parse(ev.data);
if (m.id && c.waits.has(m.id)) {
const { res, rej } = c.waits.get(m.id);
c.waits.delete(m.id);
m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
}
};
return c;
}
send(method, params = {}) {
const id = ++this.id;
this.ws.send(JSON.stringify({ id, method, params }));
return new Promise((res, rej) => this.waits.set(id, { res, rej }));
}
close() { try { this.ws.close(); } catch (e) {} }
}
(async () => {
const port = parseInt(arg('port', '9222'), 10);
if (arg('list', false)) {
const t = await (await fetch(`http://127.0.0.1:${port}/json/list`)).json();
for (const x of t) console.log(`${x.type}\t${(x.url || '').slice(0, 120)}\t${x.id}`);
return;
}
const match = arg('match', null);
const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
.filter(t => t.type === 'page' || t.type === 'iframe');
let target = match ? targets.find(t => (t.url || '').includes(match)) : null;
if (!target) target = targets[0];
if (!target) throw new Error('没有可用标签页');
const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
const params = { format: 'png', captureBeyondViewport: !!arg('clip', false) };
const clipRaw = arg('clip', null);
if (clipRaw) {
const [x, y, w, h] = String(clipRaw).split(',').map(Number);
params.clip = { x, y, width: w, height: h, scale: parseFloat(arg('scale', '1')) };
}
const r = await cdp.send('Page.captureScreenshot', params);
const out = arg('out', '/tmp/cdp_shot.png');
fs.writeFileSync(out, Buffer.from(r.data, 'base64'));
console.log(JSON.stringify({ ok: true, out, target: { url: target.url, id: target.id } }));
cdp.close();
})().catch(e => { console.error(String(e)); process.exit(1); });